Privacy policy

Who we are

Sasha Rec AB (“Sasha”, “we”), company registration number 559553-3851, c/o Recommended By, Epicenter, Malmskillnadsgatan 44 A, 111 57 Stockholm, Sweden, operates Sasha, an AI screening interviewer for recruiters. Privacy questions: privacy@sasharec.ai.

Two roles

We handle personal data in two capacities.

• • As a processor, when you are a candidate. The recruiter or employer who invited you decides why your interview data is used and for how long. We act on their instructions. For requests about your interview, contact them first; we will help them answer.
• • As a controller, for our website, demo requests and recruiter accounts. For that data this policy applies directly.

If you are a candidate

A recruiter invites you to a short screening conversation for a specific role. Sasha is an AI and says so in her first sentence. Before the call starts you see a notice and confirm you want to continue; we record that you did, and which version of the notice you saw.

What we process. Your name, email address and a one-time PIN (stored only as a hash) to let you in. Your spoken answers, turned into text as you speak; the audio is streamed for the call and never recorded or stored. If Sasha asks about salary expectations or availability and you choose to answer, we pass that to the recruiter as you said it; it is not assessed. After the call an AI evaluation reads the transcript against the role’s requirements and writes down what you said that speaks to each one, quoting your words. It produces no score and no verdict. Where the interview did not cover a requirement, it says so rather than counting it against you.

Who decides. A person at the recruiter makes the hiring decision and records it separately. Sasha never advances or rejects anyone, and no decision about you is based solely on automated processing (Article 22 GDPR). Sasha does not identify you biometrically, read emotions, or infer personality or protected characteristics; it works from what you said.

Who sees it. The recruiter who invited you, and the Sasha staff who operate the platform.

How long. Transcripts, evaluations and the recruiter’s decision are deleted automatically after the retention period the recruiter sets, which is at least six months and by default two years from the call. Your name and email stay with the recruiter’s candidate record until they delete you or close their account.

Legal basis. Set by the recruiter, usually their legitimate interest in assessing candidates. Please do not volunteer special-category data such as health, religion or political opinions; it is not needed and is not used.

Feedback. After the call you can tell us how it went. That is optional, it is not linked to your name and the hiring team does not see it. Sasha Rec AB is the controller for it, and it is kept for two years.

If you use a recruiter account

We process your work email and name (sign-in is through WorkOS, we never store a password), your organisation and role, and what you do in the product: the role profiles you confirm, your conversations with Sasha while drafting them, your hiring profiles, and your decisions about candidates. Basis: performing our agreement with your organisation. Kept while the account is active and deleted on request or when the organisation’s account is deleted.

If you request a demo

We process what you type into the form: name, work email, company, job title, company type and size, screening volume, what you hope Sasha solves, an optional phone number and comment, and whether you want product updates. We use it to reply and arrange a conversation, and we keep a copy in our CRM (Notion). Basis: steps you asked us to take before a possible agreement, and your consent for product updates, which you can withdraw by email. Kept for twelve months after our last contact, then deleted. If you joined our earlier waitlist, the same applies to that data.

If you visit the website

The site sets no analytics or advertising cookies. Your light or dark theme choice is kept in your browser’s local storage and never sent to us. Our servers keep short-lived technical logs to run the site. Inside the product we measure the candidate journey (link opened, consent given, call started, call finished) with PostHog, keyed to an opaque invitation identifier rather than to you, and without building profiles.

The EU AI Act

Sasha is an AI system used in recruitment, and the EU AI Act’s obligations for such systems apply from the dates the law sets. Two things are true today regardless of date: Sasha tells every candidate it is an AI at the start of the conversation, and a person makes every hiring decision.

Where your data goes

Data storage and our servers stay in the EU; our database is in Frankfurt. AI inference runs on a mix of EU and US infrastructure: Deepgram’s speech services run in the EU, and the language models on Microsoft Azure run in the US by default and may be processed in other Azure regions. The call runs on Daily, which carries the audio and hosts the live interview on call workers in the EU (Frankfurt), and on speech services (Deepgram in the EU; Cartesia or ElevenLabs in the United States when selected). Interview transcripts, assessments and role drafts are processed by a language-model provider. By default that is Microsoft Azure AI Foundry: what Azure stores stays in Germany, and the model runs in the US by default and may be processed in other Azure regions. Enterprise customers who require EU-only processing can get it by special arrangement, at extra cost and possibly without every feature. When selected for an organisation, OpenAI or Anthropic in the United States, or Google Cloud in the EU, is used instead. Invitation emails go through Resend and recruiter sign-in through WorkOS, both in the United States. Demo leads are copied to Notion in the United States. Every transfer outside the EU/EEA relies on the EU Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework. Our AI model providers, Microsoft Azure and Deepgram, do not use your data for training. The current list is on the service providers page.

Security

Access controls, tenant isolation enforced by database row-level security, encryption in transit, hashed PINs, append-only audit logs for privileged actions, and telemetry that excludes the content of prompts and answers. Our personnel are bound by confidentiality.

Your rights

Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent where processing relies on it.

• • Candidates: send requests to the recruiter who invited you; we will help them, including requests for a person to review and explain an assessment.
• • Website, demo and account data: privacy@sasharec.ai.

You can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) or your local supervisory authority.

Children, changes

Sasha is for adults in a professional hiring context and is not directed at children. We may update this policy; the date above changes, and for material changes we give notice first. Earlier versions on request.